Microsoft Microsoft Certifications AZ-305 Questions & Answers

• Question 261:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has deployed several virtual machines (VMs) on-premises and to Azure. Azure ExpressRoute has been deployed and configured for on-premises to Azure connectivity.

  Several VMs are exhibiting network connectivity issues.

  You need to analyze the network traffic to determine whether packets are being allowed or denied to the VMs.

  Solution: Use Azure Network Watcher to run IP flow verify to analyze the network traffic Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The Network Watcher Network performance monitor is a cloud-based hybrid network monitoring solution that helps you monitor network performance between various points in your network infrastructure. It also helps you monitor network

  connectivity to service and application endpoints and monitor the performance of Azure ExpressRoute.

  Note:

  IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule

  that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

  IP flow verify looks at the rules for all Network Security Groups (NSGs) applied to the network interface, such as a subnet or virtual machine NIC. Traffic flow is then verified based on the configured settings to or from that network interface. IP

  flow verify is useful in confirming if a rule in a Network Security Group is blocking ingress or egress traffic to or from a virtual machine.

  Reference:

  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

• Question 262:

  The application will host video files that range from 50 MB to 12 GB. The application will use certificate-based authentication and will be available to users on the internet.

  You need to recommend a storage option for the video files. The solution must provide the fastest read performance and must minimize storage costs.

  What should you recommend?

  A. Azure Files

  B. Azure Data Lake Storage Gen2

  C. Azure Blob Storage

  D. Azure SQL Database

  Correct Answer: C

  Blob Storage: Stores large amounts of unstructured data, such as text or binary data, that can be accessed from anywhere in the world via HTTP or HTTPS. You can use Blob storage to expose data publicly to the world, or to store

  application data privately.

  Max file in Blob Storage. 4.77 TB.

  Reference:

  https://docs.microsoft.com/en-us/azure/architecture/solution-ideas/articles/digital-media-video

• Question 263:

  You have an Azure subscription that contains a storage account.

  An application sometimes writes duplicate files to the storage account.

  You have a PowerShell script that identifies and deletes duplicate files in the storage account. Currently, the script is run manually after approval from the operations manager.

  You need to recommend a serverless solution that performs the following actions:

  1.

  Runs the script once an hour to identify whether duplicate files exist Sends an email notification to the operations manager requesting approval to delete the duplicate files

  2.

  Processes an email response from the operations manager specifying whether the deletion was approved

  3.

  Runs the script if the deletion was approved What should you include in the recommendation?

  A. Azure Logic Apps and Azure Functions

  B. Azure Pipelines and Azure Service Fabric

  C. Azure Logic Apps and Azure Event Grid

  D. Azure Functions and Azure Batch

  Correct Answer: A

  You can schedule a powershell script with Azure Logic Apps.

  When you want to run code that performs a specific job in your logic apps, you can create your own function by using Azure Functions. This service helps you create Node.js, C#, and F# functions so you don't have to build a complete app or infrastructure to run code. You can also call logic apps from inside Azure functions. Azure Functions provides serverless computing in the cloud and is useful for performing tasks such as these examples:

  Reference: https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-azure-functions

• Question 264:

  Your company has 300 virtual machines hosted in a VMware environment. The virtual machines vary in size and have various utilization levels.

  You plan to move all the virtual machines to Azure.

  You need to recommend how many and what size Azure virtual machines will be required to move the current workloads to Azure. The solution must minimize administrative effort.

  What should you use to make the recommendation?

  A. Azure Cost Management

  B. Azure Pricing calculator

  C. Azure Migrate

  D. Azure Advisor

  Correct Answer: C

  "Metadata discovered by the Azure Migrate appliance helps you to figure out whether servers are ready for migration to Azure, right-size servers, plans costs, and analyze application dependencies".

  https://docs.microsoft.com/en-us/learn/modules/design-your-migration-to-azure/2-plan-your-azure-migration https://docs.microsoft.com/en-us/azure/migrate/migrate-appliance#collected-data---vmware

• Question 265:

  You ate designing a SQL database solution. The solution will include 20 databases that will be 20 GB each and have varying usage patterns. You need to recommend a database platform to host the databases. The solution must meet the following requirements:

  1.

  The compute resources allocated to the databases must scale dynamically.

  2.

  The solution must meet an SLA of 99.99% uptime.

  3.

  The solution must have reserved capacity.

  4.

  Compute charges must be minimized. What should you include in the recommendation?

  A. 20 databases on a Microsoft SQL server that runs on an Azure virtual machine

  B. 20 instances of Azure SQL Database serverless

  C. 20 databases on a Microsoft SQL server that runs on an Azure virtual machine in an availability set

  D. an elastic pool that contains 20 Azure SQL databases

  Correct Answer: D

  Azure SQL Database elastic pools are a simple, cost-effective solution for managing and scaling multiple databases that have varying and unpredictable usage demands. The databases in an elastic pool are on a single server and share a set

  number of resources at a set price. Elastic pools in Azure SQL Database enable SaaS developers to optimize the price performance for a group of databases within a prescribed budget while delivering performance elasticity for each

  database.

  Guaranteed 99.995 percent uptime for SQL Database

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-sql/database/elastic-pool-overview

  https://azure.microsoft.com/en-us/pricing/details/sql-database/elastic/

  https://www.azure.cn/en-us/support/sla/virtual-machines/

  https://techcommunity.microsoft.com/t5/azure-sql/optimize-price-performance-with-compute-auto-scaling-in-azure/ba-p/966149

• Question 266:

  You plan to move a web application named App1 from an on-premises data center to Azure.

  App1 depends on a custom COM component that is installed on the host server.

  You need to recommend a solution to host App1 in Azure.

  The solution must meet the following requirements:

  1.

  App1 must be available to users if an Azure data center becomes unavailable.

  2.

  Costs must be minimized.

  What should you include in the recommendation?

  A. In two Azure regions, deploy a load balancer and a virtual machine scale set.

  B. In two Azure regions, deploy a Traffic Manager profile and a web app.

  C. In two Azure regions, deploy a load balancer and a web app.

  D. Deploy a load balancer and a virtual machine scale set across two availability zones.

  Correct Answer: D

  (https://docs.microsoft.com/en-us/dotnet/azure/migration/app-service#com-and-com-components)

  Azure App Service does not allow the registration of COM components on the platform. If your app makes use of any COM components, these need to be rewritten in managed code and deployed with the site or application.

  https://docs.microsoft.com/en-us/dotnet/azure/migration/app-service

  "Azure App Service with Windows Containers If your app cannot be migrated directly to App Service, consider App Service using Windows Containers, which enables usage of the GAC, COM components, MSIs, full access to .NET FX APIs,

  DirectX, and more."

• Question 267:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that has a security group named Group'. Group i is configured Tor assigned membership. Group I has 50 members. including 20 guest users. You need To recommend a solution for evaluating the member ship of Group1. The solution must meet the following requirements:

  1.

  The evaluation must be repeated automatically every three months

  2.

  Every member must be able to report whether they need to be in Group1

  3.

  Users who report that they do not need to be in Group 1 must be removed from Group1 automatically

  4.

  Users who do not report whether they need to be m Group1 must be removed from

  Group1 automatically.

  What should you include in me recommendation?

  A. implement Azure AU Identity Protection.

  B. Change the Membership type of Group1 to Dynamic User.

  C. Implement Azure AD Privileged Identity Management.

  D. Create an access review.

  Correct Answer: D

  https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#learn-about-access-reviews

  Have reviews recur periodically: You can set up recurring access reviews of users at set frequencies such as weekly, monthly, quarterly or annually, and the reviewers will be notified at the start of each review. Reviewers can approve or deny access with a friendly interface and with the help of smart recommendations.

  An administrator creates an access review of Group C with 50 member users and 25 guest users. Makes it a self-review. 50 licenses for each user as self-reviewers.* https://docs.microsoft.com/en-us/azure/active-directory/governance/ access-reviews-overview#example-license-scenarios

  There are 4 requirements and every single one is only met by access reviews. https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#when-should-you-use-access-reviews Dynamic User is needed if a user must be automatically granted access on base of its attributes (department, jobtitle, location, etc.) https://techcommunity.microsoft.com/t5/itops-talk-blog/dynamic-groups-in-azure-ad-and-microsoft-365/ba- p/2267494 Implementing Azure AD PIM is no solution and absolutely not necessary for access reviews. https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#where-do-you-create-reviews

• Question 268:

  You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager resource deployment in your subscription. What should you include in the recommendation?

  A. Azure Activity Log

  B. Azure Monitor action groups

  C. Azure Advisor

  D. Azure Monitor metrics

  Correct Answer: A

  Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't more than 90 days in the past. Through activity logs, you can determine:

  1.

  what operations were taken on the resources in your subscription who started the operation

  2.

  when the operation occurred

  3.

  the status of the operation

  4.

  the values of other properties that might help you research the operation

  Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs https://docs.microsoft.com/en-us/azure/automation/change-tracking

• Question 269:

  Your company has an app named App1 that uses data from the on-premises Microsoft SQL Server databases shown in the following table.

  

  App1 and the data are used on the first day of the month only. The data is not expected to grow more than 3% each year.

  The company is rewriting App1 as an Azure web app and plans to migrate all the data to Azure.

  You need to migrate the data to Azure SQL Database. The solution must minimize costs.

  Which service tier should you use?

  A. vCore-based Business Critical

  B. vCore-based General Purpose

  C. DTU-based Standard

  D. DTU-based Basic

  Correct Answer: B

  vCore tiers allow serverless and auto-pause, which matches perfect to "only used first day of month". Rest of the month, the service is paused and does not generate compute costs.

  In DTU service tier, you need to add min. 100 DTUs to get possibility for 400GB DB size. Below you only have 250GB.

  Based on this, vCore General Purpose, Serverless is cheapest solution.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-sql/database/service-tiers-dtu

• Question 270:

  Your company has the infrastructure shown in the following table.

  

  The on-premises Active Directory domain syncs to Azure Active Directory (Azure AD).

  Server1 runs an application named Appl that uses LDAP queries to verify user identities in the on-premises Active Directory domain.

  You plan to migrate Server1 to a virtual machine in Subscription1.

  A company security policy states that the virtual machines and services deployed to Subscription1 must be prevented from accessing the on-premises network.

  You need to recommend a solution to ensure that Appl continues to function after the migration. The solution must meet the security policy.

  What should you include in the recommendation?

  A. Azure AD Domain Services (Azure AD DS)

  B. an Azure VPN gateway

  C. the Active Directory Domain Services role on a virtual machine

  D. Azure AD Application Proxy

  Correct Answer: A

  Azure Active Directory Domain Services (Azure AD DS) provides managed domain services such as domain join, group policy, lightweight directory access protocol (LDAP), and Kerberos/NTLM authentication Azure AD Domain Services (Azure AD DS)-This one could work since AAD DS will bring in the existing accounts from Azure AD which in turn are synchronised from on-premise AD over AD connect. However, you would probably need to reconfigure the app and update the LDAP connection Azure Active Directory (Azure AD) supports LDAP Authentication via Azure AD Domain Services (AD DS).

  https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-ldap https://docs.microsoft.com/en-us/azure/active-directory-domain-services/synchronization https://docs.microsoft.com/en-us/azure/active-directory-domain-services/overview